US 7451149 B2
Managing access to an extranet for an extended service provider (xSP) includes decentralizing the role of access management by using cached access control list (ACL) information, and synchronizing decentralized access management roles using an authentication and authorization (AA) server. Insufficiency of session management is overcome by adopting authentication/authorization based on a web browser cookie.
1. An apparatus for managing access for an extranet, comprising:
a plurality of domain web server, to which a plurality of users are subscribed,
an authentication and authorization (AA) server for managing access authentication and authorization for the domain web server,
an authority information storing module for storing authentication information and authorization information of the users, and
a user web browser interconnected with the AA server and the domain web server,
wherein the AA server comprises:
an AA module for authenticating the users and setting Role values in an AA cookie of the authenticated user;
an access control list (ACL) cache control module for synchronizing ACL caches of the respective domain web server with the AA server; an encryption module for encrypting the AA cookies to be given to each user; and
a schema provider and user provider for providing an operation system independent of the authority information storing module,
wherein the domain web server comprises:
an ACL cache which is delivered from the AA server;
an AA module for checking, by using the ACL cache, whether the user has authority to access a requested resource;
a decryption module for decrypting the encrypted AA cookies; and
a module for processing a resource request from the user web browser,
wherein the domain web server is configured to extract the Role values from the AA cookie of the user, extracts an access control entry (ACE) of the requested resource from the ACL cache, and grant an access authority to the user if the ACE of the requested resource exists in the extracted Role values.
2. A method of managing access for an extranet, performed in the apparatus which comprises the elements in
an ACL initialization operation comprising:
an AA module of a domain web server requesting the ACL cache control module of the AA server to synchronize an ACL; and
the ACL cache control module referring the ACL from the authority information storing module and delivering the referred ACL data to the AA module of the domain web server;
an authorizing operation in authentication comprising:
a user web browser accessing the domain web server;
the AA module of the domain web server confirming access authority of the user web browser;
the user web browser requesting the authentication from an AA module of the AA server;
the AA module of the AA server referring a schema provider to the authority;
the schema provider referring an authority information storing module to a site and delivering the referred result to a user provider; and
the user provider referring the authority information storing module to the user authority to make authentication, setting Role values in an AA cookie of the authenticated user, and transmitting the AA cookie to the user web browser; and
an authority referring operation comprising:
a user web browser requesting a page (URL) access from the domain web server;
the AA module of the domain web server checking whether the user has an authority to access the requested page by comparing the Role values in the AA cookie and ACEs of the ACL cache; and
the resource request processing module processing the requested page (URL) and responses to the user web browser by sending a processed result.
3. The method of
if the user web browser requests the service enlisting or quitting, the resource request processing module of the domain web server requesting the AA module of the AA server to enlisting/quitting,
the AA module of the AA server changing the user authority information and sending the information to the user provider,
the user provider updating the user information by sending the changed information to the authority information storing module,
the AA module of the AA server reporting to the resource request processing module that the user information was changed, such that the user is informed that the enlisting/quitting process is completed.
4. The method of
an ACL synchronization operation comprising:
a supervisor instructing the ACL cache control module of the AA server to change the authority; and
the ACL cache control module requesting the authority information storing module to change the ACL, and the ACL cache of the domain web server to synchronize the ACL cache.
This application claims priority based on International Patent Application No. PCT/KR2004/002874, entitled “Extranet Access Management Apparatus and Method” by inventors Se Hyun LEE, Young Jun RYU, and Sung Kwang MOON, which claims priority of Korean Application No. 10-2003-0080752, filed on Nov. 14, 2003, and which was published in English.
The present invention relates to an access management apparatus and method for managing or controlling access to an extranet for xSP.
Conventionally, managing a user in xSP (extended service provider) was based on a simple authentication scheme. However, as online markets prevail, development of new markets became necessary. Particularly, the necessity of managing the access according to roles and resources becomes important.
Conventional products, such as access managing solutions or packages, are targeted to a small scale portal site or in-house intranet. These products not only are expensive but have low efficiency, because they adopt a real-time centralized management scheme and have a complicated hierarchical structure, and because limited users can use them.
The drawbacks of the conventional access managing method will be detailed.
(1) Extreme network traffic because of a centralized authority management
(2) Instability of authority cache
(3) Inefficiency of session management
From the foregoing, it is needed a new type of access management solution that satisfies the requirements of large scale and high performance.
It is an object of the present invention to provide a high performance apparatus and method for managing authentication and access to a large scale portal site.
Definition of the terminology:
ACE(access control entry)—Access controlling entries, such as ID, name, site domain, server list, resource list, changed URL, description, etc.
ACL(access control list)—List of ACEs
ACL cache—Memory space for application variable that a domain web server stores the ACL
Role—Set of ACEs that a user can access. A user Role can be defined by using the authority attributes of a user schema. Reduction policy of the Role information is necessary, since the amount of Role information to be stored in cookie is increased as the ACE increases in quantity. In the case of storing the Role as ACE ID list, if ACE list is assigned by a human readable name, the amount of information is remarkably augmented. Therefore, if ACE ID is expressed by a series of 62-decimal number text string of [a-zA-Z0-0], the amount of information can be reduced. That, is, in the case of 2 digits, 3,844 Role information can be expressed, and in the case of 3 digits, 238,828 Role information can be expressed (for example, it is expressed as Role=A0:B2:cZ:Ku:Z3: . . . ). Role is stored in an AA cookie when in user authentication.
User schema—Storage structure defines various user attributes, such as ID, password, etc.
AA(authentication and authorization) server—Plays a role of user authentication, Role set, ACL cache synchronization
AA cookie—Cookie including a user's authentication and authority information
To overcome “the problems of centralized authority and authorization cache”, the present invention decentralizes the role of access management by using ACL cached, and synchronizes the decentralized access management roles by using an AA server. In addition, it overcomes “inefficiency of session management” by adopting authentication/authorization based on a web browser cookie, and it additionally includes the functions of supporting the internet security standard, and processing a variety of security/encryption techniques and a user-defined access management.
The technical features of the present invention are as follows.
From the foregoing, the present invention performs high-speed authentication by using the cookies along with standard http protocol, stores and manages, when in authentication, simplified (or symbolized) Role as a cookie. By doing so, the present invention manages access by using the ACL cache and Role of cookies of the domain web server 100.
The above and other objects, features, and advantages of the present invention will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:
Now construction and operation of an access management apparatus will be discussed in detail.
The domain web server 100 comprises an AA module 102 for checking, by using the ACL cache, whether the user accesses; an ACL cache 104 which is delivered from the AA server 300; a decryption module 106 for decrypting the encrypted AA cookies; a module 108 for processing a resource request from the user web browser 500.
As will be explained in
The operation of the apparatus constructed as above will be explained. The operation of the apparatus of the present invention substantially corresponds to that of the method category of the present invention, and so the operation of the access management apparatus of
First of all,
The functional process flow of the procedure shown in
Next, referring the authority will be discussed. In the ACL cache, each the domain web server maintains the ACL related to itself as a cache, refers the user Role to resource text strings of each ACEs, and retrieves text string patterns according to the ACE resource items. This authority referring is detailed in
The functional process is reexamined through
Next, changing the user authority will be discussed.
As a functional process, with reference to
In the mean time, synchronization of the ACL cache that is essential for this invention, is explained as follows. The ACL cache is needed when each the domain web serves refers to the Role when in user's access request. The domain web server possesses the dedicated ACL cache in itself in order not to additionally communicate the AA server when referring. A cache is an application variable (i.e., a variable shared by all clients using the application) which resides in a memory of the web server.
Each of the domain web server keeps this ACL cache. Therefore, when the AA server updates the ACL, synchronization problem occurs between the ACL cache and the domain web servers. This problem can be solved by the process shown in
The present invention can solve the conventional problems, that is, 1) extreme network traffic because of a centralized authority management, 2) instability of authority cache, and 3) inefficiency of session management. Especially, the present invention is preferred to be adapted to access control for an extranet for xSP.
While the invention has been shown and described with reference to certain embodiments to carry out this invention, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.